clang-analyzer: Fixed errors reported by clang-analyzed in new node

impl.

src/knot/updates/xfr-in.c

@@ -254,6 +254,10 @@ int xfrin_process_axfr_packet(knot_pkt_t *pkt, knot_ns_xfr_t *xfr, knot_zone_con
 
 	xfrin_take_rr(answer, &rr, &rr_id);
 	if (*zone == NULL) {
+		if (rr == NULL) {
+			// Empty transfer.
+			return KNOT_EMALF;
+		}
 		// Transfer start, init zone
 		if (rr->type != KNOT_RRTYPE_SOA) {
 			return KNOT_EMALF;

src/knot/zone/semantic-check.c

@@ -701,7 +701,8 @@ static int check_nsec3_node_in_zone(knot_zone_contents_t *zone,
 
 	/* Check that the node only contains NSEC3 and RRSIG. */
 	for (int i = 0; i < knot_node_rrset_count(nsec3_node); i++) {
-		uint16_t type = nsec3_node->rrs[i].type;
+		knot_rrset_t rrset = knot_node_rrset_at(nsec3_node, i);
+		uint16_t type = rrset.type;
 		if (!(type == KNOT_RRTYPE_NSEC3 ||
 		    type == KNOT_RRTYPE_RRSIG)) {
 			err_handler_handle_error(handler, nsec3_node,